Draft personal data protection rules likely in a month: Ashwini Vaishnaw

Says planning fresh, broader approach towards broadcasting Bill

The long-anticipated rules for the Digital Personal Data Protection (DPDP) Act, 2023, are expected to be released within the next month, according to Ashwini Vaishnaw, Union minister for electronics & IT and information & broadcasting.

Speaking on Monday, the minister also addressed the controversial draft Broadcasting Services (Regulation) Bill, stating that the government is planning a fresh approach towards it with a broader consultation process, ensuring a more inclusive and transparent dialogue on regulations in the content space.

Once the rules under the DPDP Act are published, the government will initiate a public consultation period of 45 to 60 days, which could be extended as needed to gather comprehensive feedback.

“One of the major innovations that we did in the DPDP Act was that it should be digital by design, and it should be born digital,” said Vaishnaw during a press briefing. “The entire implementation structure has to be digital right from the beginning. That entire digital framework has now been completed from inception, and is now fully operational.”

This digital framework under the Act will facilitate users by streamlining interactions with platforms, including the filing of complaints and appeals, according to the minister.

Vaishnaw first spoke about the concept of a “digital by design” in June this year, and the final draft of the DPDP Act was reviewed last week.

The underlying digital infrastructure, developed by the Digital India Corporation (DIC) and the National Informatics Centre (NIC), has surpassed the beta testing stage, he noted.

The issue of age verification for children under 18 years has been resolved, a senior government official revealed. “We have solved the issue of age-verification under the requirements of the Act, and the mechanism that we’ve come up with is a very good approach.”

The DPDP Act stipulates that platforms must secure “verifiable consent” from a parent or legal guardian before processing the personal data of users under the age of 18. This provision was among the most contentious during last year’s public consultations on the Bill.

Section 9 of the DPDP Act says that before handling any personal data of a child or a person with a disability who has a legal guardian, the “data fiduciary” must first get clear and confirmed consent from the child's parent or the person’s legal guardian.